I realized it only afterwards but you can actually just look at the host['ports'] property which contains a list of ports that were found open. And you might also want to include PPTP on port 1723.